79 lines
4.7 KiB
Markdown
79 lines
4.7 KiB
Markdown
# M7 writable DATA validation
|
|
|
|
Development reference and historical context. For current operating instructions, use the [user manual](../README.md). Acceptance applies only to the source and artifacts identified in each record.
|
|
|
|
|
|
Software acceptance passed on 2026-09-21 using the x86_64 Arch build workstation,
|
|
QEMU 11.1.1, the actual AArch64 Pi kernel and static FDS tools. Physical Pi,
|
|
removable-media power loss and real shutdown/eject latency remain deferred.
|
|
|
|
## DATA acceptance workload
|
|
|
|
`make data-test` passed in `out/m7-vm.drg2a4ml/`:
|
|
|
|
- Without DATA, the ordinary UID-1000 console can write its temporary home.
|
|
Inserting a valid ext4 DATA cartridge activates `/data`; user writes persist
|
|
through eject and reinsertion while the temporary home remains separate.
|
|
- An unmanaged shell working directory and an extra bind mount each prevent
|
|
SAFE. The additional-mount check runs before stopping managed programs.
|
|
- A managed writer and its child run as UID/GID 1000 with no effective
|
|
capabilities and `no_new_privs`. At least 128 MiB is written while repeatedly
|
|
overwriting a 64 MiB file. Both processes intentionally ignore TERM.
|
|
- Eject escalates to kernel cgroup termination after its exit deadline, observes
|
|
that the complete group has exited, runs syncfs, closes its writeback handle,
|
|
unmounts normally and only then reports SAFE. The managed process count is zero.
|
|
- SAFE persists across a daemon restart until removal/reinsertion. Reinsertion
|
|
reads the previously saved user file, followed by another successful eject.
|
|
- Two DATA candidates in one discovery snapshot remain read-only. Explicit
|
|
selection activates the requested bay; another request cannot replace an
|
|
active session underneath its users.
|
|
- Pulling DATA during dirty writes produces actual kernel storage errors. The
|
|
daemon stops the remaining managed descendants and clears the vanished mount.
|
|
Eject afterward fails; this path never claims SAFE or a clean filesystem.
|
|
|
|
After the VM releases its disks, the test extracts each safely ejected ext4
|
|
partition into an ordinary file. Host e2fsprogs 1.47.4 runs `e2fsck -fn` on both;
|
|
both exit zero. `debugfs` extracts the 64 MiB stress payload, whose size and SHA-256
|
|
match the complete expected byte pattern. No host filesystem mount is involved.
|
|
See `primary-fsck.log`, `secondary-fsck.log`, `filesystem-tools.log`, and
|
|
`surprise-removal-kernel.log` in the evidence directory.
|
|
|
|
During development, removal exposed partially disappearing USB sysfs entries.
|
|
Discovery now skips incomplete individual entries, retains a still-present
|
|
mounted disk identity, and does not restart the daemon merely because another
|
|
USB device is being removed. Fixture checks and the final hotplug workload passed.
|
|
Kernel diagnostics sharing the test serial console are preserved in logs and
|
|
excluded only from the CLI JSON parser; errors are not treated as successful I/O.
|
|
|
|
## Final image and regressions
|
|
|
|
| Artifact | SHA-256 |
|
|
| --- | --- |
|
|
| Rootfs TAR, `out/rootfs-build.wFuKoS/` | `cdd7c2c8809bf144234470839cc082014f9757276e1d2f769496511c056fe127` |
|
|
| SYSTEM, `out/system-build.y7aiuhbi/` | `1675f9225ccca746045f7f999fed5b9b48d7bdd23869aa65a90f97a4219aafab` |
|
|
| Production boot FAT, `out/boot-build.abgq4799/` | `fb54582a9bd3bb393299002a65a5b0035e806e6733e81a437369a0b152b297e2` |
|
|
|
|
The rootfs has 112 packages, 1,170 AArch64 ELF files and a 408,309,760-byte TAR.
|
|
M7 adds no external Rust dependency or target package. Its process tracking uses
|
|
already-enabled Linux cgroup v2 and PID-limit support. cgroup setup belongs to
|
|
the cartridge daemon and adds no console dependency. Test filesystem tools are
|
|
the host e2fsprogs tools already used by the M2 workflow.
|
|
|
|
The final sequential pipeline exited zero: fresh rootfs and initramfs, tooling
|
|
checks, formatting/negative checks, rootfs checks, native-init VM, SYSTEM and boot
|
|
volume, all nine stage0 cases, ordinary console tests, cartridge tests and DATA
|
|
tests. Logs are `out/logs/m7-verified-*.log`. Native-init evidence is
|
|
`out/m2-vm.1sPKEy/`; the cartridge regression is `out/m6-vm._cgfbexe/`.
|
|
The temporary root test console and writer binary are confined to disposable
|
|
fixtures and do not ship in the production rootfs.
|
|
|
|
The ordinary-console trace in `out/m5-vm.6_55lhge/` measures 1,769.585 ms from the
|
|
kernel clock, versus M6's 1,753.878 ms: +15.707 ms. The ARM regression comparison
|
|
passes the 100 ms explanation threshold (`out/logs/m7-boot-regression.log`).
|
|
These individual VM observations do not establish Pi performance targets.
|
|
|
|
Attached-media writeback fault injection, broader stress and complete shutdown
|
|
ordering remain part of M10/M11. Physical flash-controller cache and power-loss
|
|
behavior require hardware. Read [DATA usage](data.md) for the implemented user
|
|
workflow and [the ledger](implementation-status.md) for remaining milestones.
|